CVE-2023-32521

published 2023-06-26

CVE-2023-32521: A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to…

Priority P2 75 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C N I H A H

A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
trend_micro_inc	trend_micro_moibile_security_for_enterprise	>= 9.8 SP5 < 9.8.3294	9.8.3294
trendmicro	mobile_security	—	—

Detection & IOCs extracted from sources · hover to see the quote

path C:\Program Files (x86)\Trend Micro\Mobile Security\cgi\TEMP\aaa\..\..\..\..\..\..\..\..\..\↗

filename web_service.dll↗

url /mdm/cgi/log/web_service.log↗

filename web_service.log↗

command python3 tmms.py -t -d '{"tmms_action":"upload_eula", "data":{"file_name":"C:\\Program Files (x86)\\Trend Micro\\Mobile Security\\cgi\\TEMP\\aaa\\..\\..\\..\\..\\..\\..\\..\\..\\..\\tmp\\delete_me.txt"}}' --noauth↗

• → Detect unauthenticated HTTP requests targeting the upload_eula action in web_service.dll with path traversal sequences (e.g., ..\) in the file_name parameter. ↗
• → Monitor for unauthenticated GET requests to /mdm/cgi/log/web_service.log, which may indicate an attacker attempting to harvest credentials or sensitive debug information. ↗
• → Look for JSON POST bodies containing tmms_action=upload_eula with file_name values including path traversal sequences (..\) outside the expected TEMP directory. ↗
• → The deletion triggered by CVE-2023-32521 runs under the Anonymous Authentication IIS account context; monitor for unexpected file deletions by that account. ↗

• · The information disclosure via web_service.log only exposes credentials when DEBUG logging is enabled, which is non-default. Environments with default logging are less exposed. ↗
• · The arbitrary file deletion runs under the IIS Anonymous Authentication account, so the blast radius depends on the privileges of that configured account. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22